feat: TokenBridge by onnovisser · Pull Request #771 · centrifuge/protocol

onnovisser · 2026-02-06T11:54:35Z

Product requirements

TokenBridge compatible with Glacis Airlift
https://www.notion.so/LiFi-bridging-contract-2b62eac24e178072a5a3ed17ebe770e3?source=copy_link

Design notes

Takes custody of user's share tokens before calling Spoke.crosschainTransferShares
Remaining msg.value optionally gets sent to a relayer, which can be set by the ProtocolGuardian
ProtocolGuardian has to file chain ID -> cent ID mapping, because Airlift only submits a destination chain ID
extraGasLimit and remoteExtraGasLimit configurable by FM

TODOs

Maybe change cent ID file method to allow setting multiple IDs at once

lemunozm · 2026-02-09T09:14:56Z

Original PR for reference: https://github.com/centrifuge/protocol-internal/pull/74

wischli

Thanks for re-opening and good job on putting this all together. I have a few questions before merging though.

wischli · 2026-02-09T13:47:46Z

src/bridge/TokenBridge.sol

+
+/// @title  TokenBridge
+/// @notice Wrapper contract for cross-chain token transfers compatible with Glacis Airlift
+contract TokenBridge is Auth, ITokenBridge {


Q for all of us: Should this contract implement Recoverable to protect against accidently sent tokens?

Looks like it's never used as a target for receiving tokens. I would say not (?)

wischli · 2026-02-09T13:48:58Z

src/bridge/TokenBridge.sol

+    }
+
+    /// @inheritdoc ITrustedContractUpdate
+    function trustedCall(PoolId poolId, ShareClassId scId, bytes memory payload) external auth {


Nit: We can use calldata payload. I discovered this as part of optimizing ARM size code. We still have several code paths in the repo using memory despite the interface declaration of calldata.

Suggested change

function trustedCall(PoolId poolId, ShareClassId scId, bytes memory payload) external auth {

function trustedCall(PoolId poolId, ShareClassId scId, bytes calldata payload) external auth {

wischli · 2026-02-09T13:49:35Z

src/bridge/TokenBridge.sol

+
+    /// @inheritdoc ITokenBridge
+    function send(address token, uint256 amount, bytes32 receiver, uint256 destinationChainId, address refundAddress)
+        public


Should this really be public or instead external?

wischli · 2026-02-09T13:54:26Z

src/bridge/TokenBridge.sol

+            poolId,
+            scId,
+            receiver,
+            uint128(amount),


CR: Should use safe method from Mathlib to improve debugging in case this edge case occurs

Suggested change

uint128(amount),

amount.toUint128(),

wischli · 2026-02-09T13:57:15Z

src/bridge/TokenBridge.sol

+            SafeTransferLib.safeApprove(token, address(spoke), type(uint256).max);
+        }
+
+        (PoolId poolId, ShareClassId scId) = spoke.shareTokenDetails(token);


Nit: We should move this up before the actual transfer because it is theoretically fallible such that we can save costs in case this check fails.

wischli · 2026-02-09T14:03:13Z

src/bridge/interfaces/ITokenBridge.sol

+    error InvalidChainId();
+    error InvalidRelayer();


Wanted to flag these are not yet used in the codebase

wischli · 2026-02-09T14:03:18Z

src/bridge/interfaces/ITokenBridge.sol

+    error InvalidToken();
+    error UnknownTrustedCall();
+    error ShareTokenDoesNotExist();
+    error FailedToTransferToRelayer();


wischli · 2026-02-09T14:04:36Z

test/bridge/unit/TokenBridge.t.sol

+        bridge.send(shareToken1, DEFAULT_AMOUNT, receiver.toBytes32(), invalidChainId, user);
+    }
+
+    function testSendInvalidToken() public {


Great tests! Could you add one for revoking a chain mapping by setting centrifugeId to 0 and then verifying send() reverts? And maybe also one for catching uint128(amount) overflow.

wischli · 2026-02-09T14:05:17Z

test/core/unit/ProtocolGuardian.t.sol

+        protocolGuardian.fileTokenBridgeRelayer(makeAddr("relayer"));
+    }
+
+    function testfileCentrifugeIdSuccess() public {


Nit: Incorrect camelcase

Suggested change

function testfileCentrifugeIdSuccess() public {

function testFileCentrifugeIdSuccess() public {

wischli · 2026-02-09T14:05:24Z

test/core/unit/ProtocolGuardian.t.sol

+        protocolGuardian.fileTokenBridgeCentrifugeId(evmChainId, CENTRIFUGE_ID);
+    }
+
+    function testfileCentrifugeIdRevertWhenNotSafe() public {


Suggested change

function testfileCentrifugeIdRevertWhenNotSafe() public {

function testFileCentrifugeIdRevertWhenNotSafe() public {

lemunozm

Some minor organizational comments, agree with William regarding the allowance/approval part. IIUC, we should change that.

But code looks really good!

lemunozm · 2026-02-10T08:04:28Z

script/FullDeployer.s.sol

+    function _relyAdapters(FullReport memory report, address ward) internal {
+        if (address(report.layerZeroAdapter) != address(0)) report.layerZeroAdapter.rely(ward);
+        if (address(report.wormholeAdapter) != address(0)) report.wormholeAdapter.rely(ward);
+        if (address(report.axelarAdapter) != address(0)) report.axelarAdapter.rely(ward);
+        if (address(report.chainlinkAdapter) != address(0)) report.chainlinkAdapter.rely(ward);
+    }


Nice idea to reduce bytecode!

lemunozm · 2026-02-10T08:13:45Z

src/bridge/TokenBridge.sol

+    /// @inheritdoc ITokenBridge
+    function file(bytes32 what, uint256 evmChainId, uint16 centrifugeId) external auth {
+        if (what == "centrifugeId") chainIdToCentrifugeId[evmChainId] = centrifugeId;
+        else revert FileUnrecognizedParam();
+        emit File(what, evmChainId, centrifugeId);
+    }


From my experience, file() methods for things other than dependencies can be somewhat messy in the end and difficult to handle. Could we use here a "normal" name like setDestination(evmChainId, centrifugeId) or something similar?

lemunozm · 2026-02-10T08:18:57Z

src/bridge/interfaces/ITokenBridge.sol

+
+    /// @notice Send a token from chain A to chain B after approving this contract with the token
+    /// @dev This function transfers tokens from the caller and initiates a cross-chain transfer
+    /// @dev These methods match the expected interface from Glacis Airlift for cross-chain token transfers


Maybe then we should move send(..) to its own interface like IGlacisAirliftTransfer or so? to reflect that and ensure this method signature remains immutable.

Do you have a reference for where this method is defined?

lemunozm · 2026-02-10T08:29:15Z

src/bridge/TokenBridge.sol

+
+        SafeTransferLib.safeTransferFrom(token, msg.sender, address(this), amount);
+        if (IERC20(token).allowance(address(this), address(spoke)) == 0) {
+            SafeTransferLib.safeApprove(token, address(spoke), type(uint256).max);


Yes, I also think the allowance is never checked. I think approval is something the user of TokenBridge should do before call to TokenBridge for leave TokenBridge to handle the transfer funds.

lemunozm · 2026-02-10T08:30:26Z

src/bridge/TokenBridge.sol

+            uint128(amount),
+            limits.extraGasLimit,
+            limits.remoteExtraGasLimit,
+            relayer != address(0) ? relayer : refundAddress // Transfer remaining ETH to relayer if set


Why not always to the refundAddress? No fully understand the need of the relayer, could you extend?

lemunozm · 2026-02-10T08:30:43Z

src/bridge/TokenBridge.sol

+
+/// @title  TokenBridge
+/// @notice Wrapper contract for cross-chain token transfers compatible with Glacis Airlift
+contract TokenBridge is Auth, ITokenBridge {


Looks like it's never used as a target for receiving tokens. I would say not (?)

lemunozm · 2026-02-10T08:35:13Z

test/bridge/integration/TokenBridge.t.sol

+    }
+
+    /// forge-config: default.isolate = true
+    function testSendWithRelayerSuccess() public {


IIUC, the relayer does not imply any new interaction with the system regarding the normal testSendSuccess(). I think the good usage of the relayer is already covered by UTs, could it be?

onnovisser added 2 commits February 6, 2026 12:50

token bridge

bda6695

remove send with outputToken

1586ccc

onnovisser requested review from hieronx, lemunozm and wischli February 6, 2026 11:54

remove send with token test

686fd21

get FullActionBatcher below bytecode limit

bca6b8d

wischli reviewed Feb 9, 2026

View reviewed changes

lemunozm reviewed Feb 10, 2026

View reviewed changes

	function trustedCall(PoolId poolId, ShareClassId scId, bytes memory payload) external auth {
	function trustedCall(PoolId poolId, ShareClassId scId, bytes calldata payload) external auth {

	function testfileCentrifugeIdSuccess() public {
	function testFileCentrifugeIdSuccess() public {

	function testfileCentrifugeIdRevertWhenNotSafe() public {
	function testFileCentrifugeIdRevertWhenNotSafe() public {

Conversation

onnovisser commented Feb 6, 2026

Product requirements

Design notes

TODOs

Uh oh!

lemunozm commented Feb 9, 2026

Uh oh!

wischli left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lemunozm left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lemunozm left a comment •

edited

Loading